5 ms·

> The difference is that cybercrime is self-solving: when companies start losing enough to really impact their bottom line, they'll finally have incentive to in

> The difference is that cybercrime is self-solving: when companies start losing enough to really impact their bottom line, they'll finally have incentive to invest more in proper cybersecurity. Let's drop "cyber" for a second. Suppose some (potentially, foreign state sponsored) actor starts to physically attack/kidnap company employees in company's home country that is starts to affect the bottom line. No one would say "They have to start investing more into security". It would be normal for the company to totally offload the problem on the home state. Now, getting back to "cybersecurity": why company is supposed to handle it instead of offloading the problem on the state?

lanternfish 6y ago
You're still supposed to put locks on your doors even though it's the police's 'job' to prevent property crime. Moreover, I don't think many tech companies want to give the state the access required to impliment preventative security measures for them, they'd rather role them themselves to maintain control.
- helge9210 6y ago
  > You're still supposed to put locks on your doors Locks are for honest people. > to impliment preventative security measures for them That's not a job of the state. The job of the state is to punish (cyber)criminals. And it's not the harshness of the punishment that matters, it's the inevitability.
  - mlyle 6y ago
    > Locks are for honest people. That's a great slogan. But-- your (cyber)security stance obviously affects your risk. There are things you can do with business model, stance, and organizational controls that absolutely affect your exposure to both cybercrime and real-world crime. Your home state can absolutely provide help in your strategy against (cyber)crime, but surely we also should probably avoid getting blackout drunk and flashing large sums of cash around dense urban cores, too.
chadash 6y ago
I don’t believe this is true. Wealthy companies that do business in dangerous countries tend to pay quite a bit for security of key employees. If you are a white collar worker of MegaCorp Oil traveling to Iraq for business, you will be provided with security. If you are a local Iraqi working in the oil fields, you can probably expect less security, precisely because your loss won’t affect the bottom line. But even so, private security is common in many factories and other company facilities, even in the US. Pretty much every skyscraper in NYC has security employees even though you can call the police there. If New York became more dangerous, I assure you security budgets would go up
- helge9210 6y ago
  You're right, that's why I deliberately limited the scope of the argument to "home country".
- patja 6y ago
  This reminds me that there is a fascinating Econtalk podcast episode on the subject of how the kidnapping insurance market works. Companies who have employees working in parts of the world where they are at risk of kidnapping for ransom have access to insurance against this risk. Two of the things that struck me about this market are (a) the insurance companies require their customers to get serious about mitigating the risk. Employees all have to attend training on how to avoid kidnapping and what to do when it happens, the insurance customer has to take other measures to limit where they go, the customer has to beef up physical security, etc. And there are some situations they refuse to insure, so that's a big red flag. The insurance company becomes a partner in doing everything they can to prevent kidnappings. and (b) customers are sworn to secrecy and may not reveal that they have this insurance. Employees don't know they are insured against kidnapping. They don't want kidnapped employees spilling the beans. The insurers have local negotiators in their employ who often have longstanding relationships with the kidnappers. Anyways, a bit tangential, but I learned a lot about this niche industry, and it gave me more of an appreciation for how insurers can raise the professionalism of their customers in their efforts to minimize risks. A similar approach with the benefit of setting standards could definitely apply to cybercrime insurance. https://www.econtalk.org/anja-shortland-on-kidnap/ https://www.econtalk.org/anja-shortland-on-kidnap/
Nasrudith 6y ago
It isn't kidnapping - operating under physical assumptions betrays a lack of understanding of the digital. It is the same fallacy as the airforce roots in thinking that the best defense is a good offense for cybersecurity. We don't have wars where engineers do some work and render soldiers intrinsically immune to grenades but we can prevent buffer overflow attacks by not using bad functions. We don't need to develop new police practice to deal with every new house design or modification. Especially given that computers themselves are hijackable you cannot rely upon ad bacculum cybersecurity.
webmaven 6y ago
> Now, getting back to "cybersecurity": why company is supposed to handle it instead of offloading the problem on the state? To a certain extent it does get offloaded, just like other crimes. But also like other crimes, businesses have a role to play in prevention, and basic competency in security should be expected. It's 2021. If you employ more security guards than cybersecurity pros, you may be doing it wrong.

lanternfish 6y ago

You're still supposed to put locks on your doors even though it's the police's 'job' to prevent property crime. Moreover, I don't think many tech companies want to give the state the access required to impliment preventative security measures for them, they'd rather role them themselves to maintain control.

helge9210 6y ago
> You're still supposed to put locks on your doors Locks are for honest people. > to impliment preventative security measures for them That's not a job of the state. The job of the state is to punish (cyber)criminals. And it's not the harshness of the punishment that matters, it's the inevitability.
- mlyle 6y ago
  > Locks are for honest people. That's a great slogan. But-- your (cyber)security stance obviously affects your risk. There are things you can do with business model, stance, and organizational controls that absolutely affect your exposure to both cybercrime and real-world crime. Your home state can absolutely provide help in your strategy against (cyber)crime, but surely we also should probably avoid getting blackout drunk and flashing large sums of cash around dense urban cores, too.

chadash 6y ago

I don’t believe this is true. Wealthy companies that do business in dangerous countries tend to pay quite a bit for security of key employees. If you are a white collar worker of MegaCorp Oil traveling to Iraq for business, you will be provided with security. If you are a local Iraqi working in the oil fields, you can probably expect less security, precisely because your loss won’t affect the bottom line. But even so, private security is common in many factories and other company facilities, even in the US. Pretty much every skyscraper in NYC has security employees even though you can call the police there. If New York became more dangerous, I assure you security budgets would go up

helge9210 6y ago
You're right, that's why I deliberately limited the scope of the argument to "home country".
patja 6y ago
This reminds me that there is a fascinating Econtalk podcast episode on the subject of how the kidnapping insurance market works. Companies who have employees working in parts of the world where they are at risk of kidnapping for ransom have access to insurance against this risk. Two of the things that struck me about this market are (a) the insurance companies require their customers to get serious about mitigating the risk. Employees all have to attend training on how to avoid kidnapping and what to do when it happens, the insurance customer has to take other measures to limit where they go, the customer has to beef up physical security, etc. And there are some situations they refuse to insure, so that's a big red flag. The insurance company becomes a partner in doing everything they can to prevent kidnappings. and (b) customers are sworn to secrecy and may not reveal that they have this insurance. Employees don't know they are insured against kidnapping. They don't want kidnapped employees spilling the beans. The insurers have local negotiators in their employ who often have longstanding relationships with the kidnappers. Anyways, a bit tangential, but I learned a lot about this niche industry, and it gave me more of an appreciation for how insurers can raise the professionalism of their customers in their efforts to minimize risks. A similar approach with the benefit of setting standards could definitely apply to cybercrime insurance. https://www.econtalk.org/anja-shortland-on-kidnap/ https://www.econtalk.org/anja-shortland-on-kidnap/

Nasrudith 6y ago

It isn't kidnapping - operating under physical assumptions betrays a lack of understanding of the digital. It is the same fallacy as the airforce roots in thinking that the best defense is a good offense for cybersecurity. We don't have wars where engineers do some work and render soldiers intrinsically immune to grenades but we can prevent buffer overflow attacks by not using bad functions. We don't need to develop new police practice to deal with every new house design or modification. Especially given that computers themselves are hijackable you cannot rely upon ad bacculum cybersecurity.

webmaven 6y ago

> Now, getting back to "cybersecurity": why company is supposed to handle it instead of offloading the problem on the state? To a certain extent it does get offloaded, just like other crimes. But also like other crimes, businesses have a role to play in prevention, and basic competency in security should be expected. It's 2021. If you employ more security guards than cybersecurity pros, you may be doing it wrong.